Error: TLS Authentication Failed on OpenVpn, happens randomly

dimig45

Hello Guys.
I implemented 5 new openvpn servers with radius and ldap authentication via PFsense, so that each department has its own subnet and its own firewall policies.

The issue that we are facing is that our clients (linux mac and windows OS) started to disconnect randomly, after 10 min - 8 hours.
After that, no one could reconnect again, unless if the connection was closed manually. Also sometimes even though, the connection was closed manually, some clients couldn't establish new connection. Probably the connection was not closed from the server side.
This is strange because server allows concurrent connections with the same common name.

Today I faced the issue again on my Mac OS through terminal. I checked immediately if my ISP changed my public ip but it was the same.
On my firewall I have a dnat on my public ip to a DMZ vlan as you can see below (10.0.110.11) which permits openvpn ports.

I made some changes since my first configuration.
The changes that I made are:

-Add my internal ntp server to the Pfsense Service and pushed it through openvpn.
-Disabled ncp
-Also I changed the keepalive to 30 120 but then I turned it back to its default
-The same happens to all the other clients on my different openvpn servers.
-Add also for windows clients on my server and on client config:
-tun-mtu 1500 fragment 1300 mssfix but then i rolled it back since i didn't see any change

Finally I noticed that from Public Static IP I have not been disconnected since yesterday morning. So, all the disconnections are from Dynamic Public ip

Your help guys would be appreciated.

I removed the flow option and I was disconnected again after 1 hour

Here are the logs of my OpenVPN server.

Dec 28 18:42:16 demovpn openvpn: user 'secret' authenticated
Dec 28 20:42:16 demovpn openvpn[47932]: x.x.x.x:1194 [secret] Peer Connection Initiated with [AF_INET]x.x.x.x:1194
Dec 28 20:42:16 demovpn openvpn[47932]: secret/x.x.x.x:1194 MULTI_sva: pool returned IPv4=192.168.95.2, IPv6=(Not enabled)
Dec 28 21:02:51 demovpn openvpn[47932]: secret/x.x.x.x:1194 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Dec 28 21:02:51 demovpn openvpn[47932]: secret/x.x.x.x:1194 TLS Error: TLS handshake failed
Dec 28 21:04:21 demovpn openvpn[47932]: secret/x.x.x.x:1194 [secret] Inactivity timeout (--ping-restart), restarting

Here are the client logs

Fri Dec 28 20:42:10 2018 OpenVPN 2.4.6 x86_64-apple-darwin17.5.0 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] built on May  1 2018
Fri Dec 28 20:42:10 2018 library versions: OpenSSL 1.0.2q  20 Nov 2018, LZO 2.10
Enter Auth Username:secret
Enter Auth Password:
Fri Dec 28 20:42:15 2018 TCP/UDP: Preserving recently used remote address: [AF_INET]x.x.x.x:1194
Fri Dec 28 20:42:15 2018 UDP link local (bound): [AF_INET][undef]:1194
Fri Dec 28 20:42:15 2018 UDP link remote: [AF_INET]x.x.x.x:1194
Fri Dec 28 20:42:16 2018 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Fri Dec 28 20:42:16 2018 [openvpn-int-ca] Peer Connection Initiated with [AF_INET]x.x.x.x:1194
Fri Dec 28 20:42:17 2018 Options error: Unrecognized option or missing or extra parameter(s) in [PUSH-OPTIONS]:5: block-outside-dns (2.4.6)
Fri Dec 28 20:42:17 2018 Options error: Unrecognized option or missing or extra parameter(s) in [PUSH-OPTIONS]:6: register-dns (2.4.6)
Fri Dec 28 20:42:17 2018 Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16)
Fri Dec 28 20:42:17 2018 Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16)
Fri Dec 28 20:42:17 2018 Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16)
Fri Dec 28 20:42:17 2018 Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16)
Fri Dec 28 20:42:17 2018 Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16)
Fri Dec 28 20:42:17 2018 Opened utun device utun5
Fri Dec 28 20:42:17 2018 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Fri Dec 28 20:42:17 2018 /sbin/ifconfig utun5 delete
ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
Fri Dec 28 20:42:17 2018 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
Fri Dec 28 20:42:17 2018 /sbin/ifconfig utun5 192.168.95.2 192.168.95.2 netmask 255.255.255.0 mtu 1500 up
add net 192.168.95.0: gateway 192.168.95.2
add net x.x.0.0: gateway 192.168.95.1
Fri Dec 28 20:42:17 2018 Initialization Sequence Completed
Fri Dec 28 21:01:46 2018 [openvpn-int-ca] Inactivity timeout (--ping-restart), restarting
Fri Dec 28 21:01:46 2018 SIGUSR1[soft,ping-restart] received, process restarting
Fri Dec 28 21:01:51 2018 TCP/UDP: Preserving recently used remote address: [AF_INET]x.x.x.x:1194
Fri Dec 28 21:01:51 2018 UDP link local (bound): [AF_INET][undef]:1194
Fri Dec 28 21:01:51 2018 UDP link remote: [AF_INET]x.x.x.x:1194

And here are the server config

dev ovpns1
verb 3
dev-type tun
dev-node /dev/tun1
writepid /var/run/openvpn_server1.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp4
cipher AES-128-CBC
auth SHA256
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
client-connect /usr/local/sbin/openvpn.attributes.sh
client-disconnect /usr/local/sbin/openvpn.attributes.sh
local 10.0.110.11
tls-server
server 192.168.95.0 255.255.255.0
client-config-dir /var/etc/openvpn-csc/server1
username-as-common-name
plugin /usr/local/lib/openvpn/plugins/openvpn-plugin-auth-script.so /usr/local/sbin/ovpn_auth_verify_async user UmFkaXVzX09yY2E= true server1 1194
tls-verify "/usr/local/sbin/ovpn_auth_verify tls 'openvpn-int-ca' 1"
lport 1194
management /var/etc/openvpn/server1.sock unix
push "route x.x.0.0 255.0.0.0"
push "dhcp-option DOMAIN xxxxxxxxxxx
push "dhcp-option DNS x.x.0.10"
push "dhcp-option DNS x.x.0.15"
push "block-outside-dns"
push "register-dns"
push "dhcp-option NTP x.x.0.10"
push "dhcp-option NTP x.x.0.15"
duplicate-cn
ca /var/etc/openvpn/server1.ca
cert /var/etc/openvpn/server1.cert
key /var/etc/openvpn/server1.key
dh /etc/dh-parameters.2048
tls-auth /var/etc/openvpn/server1.tls-auth 0
ncp-disable
persist-remote-ip
float
topology subnet

and my client config without of course the certs and key

dev tun
persist-tun
persist-key
cipher AES-128-CBC
auth SHA256
tls-client
client
resolv-retry infinite
remote x.x.x.x 1194 udp
verify-x509-name "openvpn-int-ca" name
auth-user-pass
remote-cert-tls server

TinCanTech

Re: Error: TLS Authentication Failed on OpenVpn, happens randomly

Then the cause is not openvpn ..

My experience with pfSense is enough to know that pfsense can be easily broken by accident.
And your setup is exactly the sort of thing that goes wrong .. IE. this:

dimig45 wrote On my firewall I have a dnat on my public ip to a DMZ vlan as you can see below (10.0.110.11) which permits openvpn ports.

I made some changes since my first configuration.

Your client log file above shows that your client connected, which means openvpn is working,
and then timed out some 20 minutes later, which could be anything .. probably some network change.

dimig45

@TinCanTech Thank you for you reply. Although I have experienced some issues with pfsense,
the pfsense installation is fresh and is associated only for OpenVPN.
Also on my previous installation, pfsense was serving PPTP with the same firewall config and everything was ok.
The reason why I preferred Pfsense was that I wanted openvpn with Ldap authentication due to I am new to linux.

So what do you suggest to do?any ideas?

TinCanTech

Like I said:

TinCanTech wrote
Re: Error: TLS Authentication Failed on OpenVpn, happens randomly
Then the cause is not openvpn ..

Your client log file above shows that your client connected, which means openvpn is working,
and then timed out some 20 minutes later, which could be anything .. probably some network change.

dimig45 wrote So what do you suggest to do?

Learn Linux and pfSense ..

There is no setting in openvpn which will magically fix your network.

dimig45

Network is ok! I have plenty of experience on networking and it was the first thing i checked. I am working with pfsense for at least 3 years. So, when I had pptp service on the same server on the same pfsense version with the same firewall config, everything worked great for a year.
So, the only thing I can imagine is the possibility that the pfsense and radius server loose connection for an unknown reason.